diff --git a/backend/config/settings.py b/backend/config/settings.py
index 46291d9c..6d18e4f3 100644
--- a/backend/config/settings.py
+++ b/backend/config/settings.py
@@ -276,14 +276,18 @@ LOGOUT_REDIRECT_URL = "/login/"
 # background.js makes the request so HTTP_ORIGIN will be from extension
 if environ.get("DISABLE_CORS"):
     # disable cors
-    CORS_ORIGIN_ALLOW_ALL = True
+    CORS_ALLOW_ALL_ORIGINS = True
 else:
     CORS_ALLOWED_ORIGIN_REGEXES = [
         r"moz-extension://*",
         r"chrome-extension://*",
     ]
+    CORS_ORIGIN_WHITELIST = ["http://localhost:3000", "http://localhost:8000"]
+    CSRF_TRUSTED_ORIGINS = ["http://localhost:3000", "http://localhost:8000"]
     CORS_ALLOWED_ORIGINS = ["http://localhost:3000"]
 
+CORS_ALLOW_CREDENTIALS = True
+
 
 CORS_ALLOW_HEADERS = list(default_headers) + [
     "mode",